🚨 Bug Bounty / Red Team Tip

CVE-2026-21643 — Critical Pre-Auth SQL Injection (CVSS 9.1) in FortiClient EMS 7.4.4 (multi-tenant mode only)

Unauthenticated attackers can inject arbitrary SQL via the Site HTTP header to the public endpoint /api/v1/init_consts (or login endpoint). This happens before authentication and hits the PostgreSQL backend with superuser-level access in many setups → full DB dump, schema extraction, or RCE (via PostgreSQL features like COPY FROM PROGRAM).

- Affected: Only FortiClient EMS 7.4.4 (multi-tenant/Sites feature enabled)
- Not affected: 7.2.x, 8.0.x, single-site deployments
- Fixed: Upgrade to 7.4.5 or later
- Status: Actively exploited in the wild + public PoCs available

Main Detail Article (Highly Recommended):
Bishop Fox deep-dive with exploitation paths, payloads (e.g., pg_sleep(5) for blind testing), and lab results →
https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4

Public PoC (GitHub):
https://github.com/0xBlackash/CVE-2026-21643

Useful Google/Shodan Dorks:
- http.title:"FortiClient EMS" "7.4.4"
- http.html:"FortiClient Enterprise Management Server"
- http.favicon.hash: -specific-hash (or search for EMS login page)
- Shodan: "Model: FCTEMS" or "FortiClient EMS"

Quick Check:
If your EMS login page is internet-facing and running 7.4.4 with multi-tenant enabled → patch ASAP or block public access. Thousands of instances are exposed (Shadowserver ~2k+, Shodan ~1k+).

High-value target for hunters. Patch or restrict immediately!

#BugBounty #RedTeam #Fortinet #CVE202621643 #SQLi